ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ SOME WORDS ÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ Before saying anything I have to take a short break and thank all the people who helped me, directly or not in making all the stuff in here: Dics - you rule! Virtual Daemon - great buddy! All members from the SLAM group for supporting me and for not getting upset every time I had stupid idea ;-) Thanx guys... And now a little about the articles in here... As much as I could, I tried to correct them, justify them nicely and so on. I know you will hate me for not putting anything new here (the Ring0 article is missing) but I only released this to have it tested by all of you. Also for those who found my humble articles something interesting, they can watch them in a better way... And, of course, don't be mad if you still find mistakes or typoes and such. They have the same reason as the first ones: the fact that I maybe was tired and the lack of time. Also, please know that it is not very easy to make all this by your own... You need all the help you can get in bug checking and testing... Something regarding the Portable Executable Infection article. some people told me they found a bug regarding the second method of adding a new section. Frankly, I couldn't find the bug. Maybe my goat files were not ok... Anyhow, the message is: use section increase... It's much more reliable and much more hard to remove. About the old stuff in DOS: Whiplash 1.0 This is an oldie but goldie. My first ever finished virus !! At about two months since I started looking into viruses I came up with this virus. It has a few nice things, but a lot of bugs. I release it for all those beginners to see how the first ever code will look and the way it will hang ;-)), and I release it as I don't care about DOS viruses now. This was coded in early 1997. Whiplash 2.0... This is an oldie but goldie. My first virus which actually worked !! Check it out... It's a full DOS COM/EXE infector, and runtime disinfector. It has a few bugs which prevents it from spreading anyway. I decided to release it as I am thru with DOS viruses. It was written in early 1997. The WHIP3.ASM file even if it looks like a virus, it is not. It is only the beginning of a virus. I have never finished it because I moved to win32. Anyhow, the reason I present it up here is the fact that it is still special. When I started working on it I wanted it to be a very memory stable virus, almost imposible to remove from memory without hanging the system. Therefore, this code does this: - alocates 4 different memory areas - moves parts of the virus in those areas - makes links thru interrupt bodies between areas - encrypts the memory zones in different ways. - everytime an interrupt is called the memory gets decryptes - there are different checksums on memory The program as you see it here only goes resident stealth and when a program runs it displays: "An executable is about to be run..." That's all that it does! Also, you will nottice the now confirmed functional Win32 viruses Undertaker and Manowar. In Undertaker you can see the use of the FPU. Taylor procedure I present in the Anti-emulation article. As for the future I have some projects I work on: Ring0 residency, Process spawn recidency, some virus related essays, the Multiple Opcode Fantasies 32bit (almost finished), and some more... So, I am preety busy. Regarding MOF, you will not be able to compile it, unless you have the asmwiz.lib file in the same directory (get it from the net, it's freeware). Also, for the win32 viruses you will need the pewrsec utility written by JQwerty (get it from the 29A issue #2)... That's it for now... Here are all my grets: ³ antigen ³ ³ aurodreph the drow ³ ³ automag ³ ³ blue skull ³ ³ b0z0 ³ ³ coke ³ ³ cyberyoda ³ ³ dark angel ³ ³ dark fiber ³ ³ darkman ³ ³ dics ³ ³ executioner ³ ³ forms ³ ³ gryio ³ ³ hellfire ³ ³ hellraiser ³ ³ jacky qwerty ³ ³ kidchaos ³ ³ lord natas ³ ³ lovingod ³ ³ qark ³ ³ quantum ³ ³ memory lapse ³ ³ metabolis ³ ³ methyl ³ ³ mr sandman ³ ³ murkry ³ ³ murphy ³ ³ opic ³ ³ overlord ³ ³ raajat ³ ³ raid ³ ³ rp ³ ³ shaitan ³ ³ stealth warrior ³ ³ super ³ ³ t2000 ³ ³ tcp ³ ³ the unforgiven ³ ³ yesna ³ ³ trigger ³ ³ virogen ³ ³ virtual daemon ³ ³ virus buster ³ ³ wild w0rker ³ ³ wintermute ³ ³ wizard555 ³ ³ zoom23 ³ Also I would like to salute the groups: - SLAM - - IKX - - 29A - - DDT - - STEALTH - - CODEBREAKERS - And also my old time favorite groups that meant something: - VLAD - - INSANE REALITY - - P/S - Special greetings go to: ! Virtual Daemon ! ! Darkman ! ! DiCS ! ! The Unforgiven ! ! Mr.Sandman ! And all the guys on the Undernet #vir IRC channel... Good luck and be well, ppl !!! All the Best, ÚÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿ ³ Lord Julus - 1999 ³ ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ